Something seems to have changed in the debmirror prorgam on lenny:

gpgv: Signature made Sun Mar  1 16:27:33 2009 CET using DSA key ID 1F41B907
[GNUPG:] ERRSIG 07DC563D1F41B907 17 2 00 1235921253 9
[GNUPG:] NO_PUBKEY 07DC563D1F41B907
gpgv: Can’t check signature: public key not found

This error turned up when I tried to mirror debian-multimedia.org after upgrading debmirror. Apparently the new version looks for the keys in ~/.gnupg/trustedkeys.gpg. If you installed the debian-multimedia-keyring package, you can use the following:

 gpg –no-default-keyring -a –keyring /usr/share/keyrings/debian-multimedia-keyring.gpg –export 07DC563D1F41B907 | gpg –no-default-keyring –keyring ~/.gnupg/trustedkeys.gpg –import –

This imports the current key into the new file.